{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24716 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2022-24716 is a high-severity path traversal vulnerability in icingaweb2, published on 8 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-24716 and fix it if it is affected.\n\nWhat it is: CVE-2022-24716 is a high-severity path traversal vulnerability in icingaweb2, published on 8 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24716 exists.\n\nAffected product: icingaweb2. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-24716/ (Markdown: https://insights.sbomify.com/CVE-2022-24716/index.md)","id":"CVE-2022-24716","markdown":"https://insights.sbomify.com/CVE-2022-24716/index.md","name":"CVE-2022-24716","record":{"aliases":["DEBIAN-CVE-2022-24716","GHSA-5p3f-rh28-8frw","UBUNTU-CVE-2022-24716"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Icinga Web 2","requires_auth":"none","summary":"Unauthenticated attackers can read local system files, including database credentials, via path traversal in Icinga Web 2.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"icinga_web_2","vendor":"icinga"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.","ecosystems":[],"exploits":{"exploitdb":1,"first_seen":"2022-05-09","github_poc":5,"max_poc_stars":3,"metasploit":1,"nuclei":1,"refs":[{"date":"2023-03-27T02:22:23Z","kind":"github_poc","ref":"https://github.com/0x0Jackal/CVE-2022-24716","stars":3,"title":"Arbitrary File Disclosure Vulnerability in Icinga Web 2 \u003c2.8.6, \u003c2.9.6, \u003c2.10"},{"date":"2022-05-09","kind":"metasploit","ref":"auxiliary/scanner/http/icinga_static_library_file_directory_traversal","stars":null,"title":"Icingaweb Directory Traversal in Static Library File Requests"},{"date":"2023-03-20T07:01:53Z","kind":"github_poc","ref":"https://github.com/gmh5225/CVE-2022-24716","stars":0,"title":"Arbitrary File Disclosure Vulnerability in Icinga Web 2 \u003c2.8.6, \u003c2.9.6, \u003c2.10"},{"date":"2023-03-26T01:03:07Z","kind":"github_poc","ref":"https://github.com/pumpkinpiteam/CVE-2022-24716","stars":0,"title":null},{"date":"2023-04-08","kind":"exploitdb","ref":"51329","stars":null,"title":"Icinga Web 2.10 - Arbitrary File Disclosure"},{"date":"2023-05-20T18:43:46Z","kind":"github_poc","ref":"https://github.com/antisecc/CVE-2022-24716","stars":0,"title":null},{"date":"2024-04-22T01:17:01Z","kind":"github_poc","ref":"https://github.com/gmh5225/CVE-2022-24716-2","stars":0,"title":"CVE-2022-24716 (Arbitrary File Disclosure Icingaweb2)"},{"date":null,"kind":"nuclei","ref":"http/cves/2022/CVE-2022-24716.yaml","stars":null,"title":"Icinga Web 2 - Arbitrary File Disclosure"}],"tier":"weaponised"},"has_fix":true,"headline":"Path traversal in Icinga Web 2","id":"CVE-2022-24716","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2022"},"n_packages":0,"n_references":4,"next":{"headline":"Cross Site Scripting (XSS) in ssr-pages","id":"CVE-2022-24717"},"packages":[],"prev":{"headline":"Arbitrary code execution for authenticated users in Icinga Web 2","id":"CVE-2022-24715"},"products":["icingaweb2"],"published":"2022-03-08","related":[{"cvss_score":9.8,"headline":"Code injection in n/a","id":"CVE-2018-18249","kev_date_added":null,"published":"2018-12-17"},{"cvss_score":8.5,"headline":"Arbitrary code execution for authenticated users in Icinga Web 2","id":"CVE-2022-24715","kev_date_added":null,"published":"2022-03-08"},{"cvss_score":7.7,"headline":"Icinga Web 2 DOM-based XSS vulnerability","id":"CVE-2025-27404","kev_date_added":null,"published":"2025-03-26"},{"cvss_score":7.7,"headline":"Icinga Web 2 has XSS in embedded content","id":"CVE-2025-27405","kev_date_added":null,"published":"2025-03-26"},{"cvss_score":7.5,"headline":"Other in n/a","id":"CVE-2018-18250","kev_date_added":null,"published":"2018-12-17"},{"cvss_score":6.5,"headline":"Cross-site request forgery in n/a","id":"CVE-2018-18246","kev_date_added":null,"published":"2018-12-17"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-23","vendors":["Icinga"]},"summary":"Unauthenticated attackers can read local system files, including database credentials, via path traversal in Icinga Web 2.","url":"https://insights.sbomify.com/CVE-2022-24716/"}